test(ipc): malformed IPC frame boundary harness — pin docs/abi/ipc-wire.md error model on bad header/length/opcode (BUILD_ROADMAP §6.2, §7)

[rwrife]

Motivation

BUILD_ROADMAP §7 freezes the IPC wire format as one of the four ABI surfaces, with the canonical spec at docs/abi/ipc-wire.md. §6.2 lists matrix dimensions for the nightly grant/deny permutations but the negative-path coverage there is capability-shaped, not wire-shaped: there is no test asserting how the kernel responds when a sender hands the IPC subsystem a malformed frame (truncated header, oversized declared length, unknown opcode, reserved-bit set).

Today the existing ipc_bounds host gate (wired in #514/#515) covers bounds on a well-formed frame; syscall_entry_stub covers the syscall boundary. The wire-format error model itself is documented but not pinned by a dedicated negative-path test.

This is the smallest defensible slice that pins the frozen wire format under §7 and feeds the §6.2 matrix.

Scope

Add a host-fixture test that hands the kernel IPC entry point a parameterised set of malformed frames and asserts every one returns the documented error code from docs/abi/ipc-wire.md (e.g. IPC_ERR_BAD_HEADER, IPC_ERR_BAD_LENGTH, IPC_ERR_UNKNOWN_OPCODE) without panicking, leaking state, or modifying receiver mailboxes. No kernel API changes — this is a test-only slice that exercises today's error model and pins it against drift.

Acceptance criteria / done-when

• tests/ipc_wire_malformed_test.c covers at minimum:
  • Truncated header (length field shorter than fixed header size)
  • Declared payload length exceeds the bounded max
  • Declared payload length underflows (claims more bytes than supplied)
  • Unknown opcode (outside the registry in docs/abi/ipc-wire.md)
  • Reserved/zero-fields-must-be-zero violation
  • Valid header but capability handle field is structurally invalid (already covered separately by cap-handle tests — assert these stay separable here; do not duplicate)
• Each subcase emits a sub-marker, e.g.:
  • TEST:PASS:ipc_wire_malformed:truncated_header_returns_bad_header
  • TEST:PASS:ipc_wire_malformed:oversized_length_returns_bad_length
  • TEST:PASS:ipc_wire_malformed:underflow_length_returns_bad_length
  • TEST:PASS:ipc_wire_malformed:unknown_opcode_returns_unknown_opcode
  • TEST:PASS:ipc_wire_malformed:reserved_bits_set_rejected
  • Umbrella TEST:PASS:ipc_wire_malformed
• Every malformed-frame subcase asserts the receiver mailbox state is unchanged (no partial delivery, no half-state)
• Build script build/scripts/test_ipc_wire_malformed.sh (+ .ps1 peer per AGENTS.md) and wired into build/scripts/test.sh ipc_wire_malformed
• Wired into validate_bundle.sh TEST_TARGETS (parity with ipc_bounds from ci(bundle): wire netlib_url_scheme/syscall_entry_stub/ipc_bounds/harness_defense into TEST_TARGETS (substrate host gates) #514)
• docs/abi/ipc-wire.md:
  • Cross-link added to the new test under an Acceptance/Verification section (same shape as the cap-handle/manifest specs)
  • "Last verified against commit" stamp bumped post-merge (standard ci(abi): validate_abi_stamps strict mode — promote 'no_stamp_line' SKIP to FAIL so future ABI docs cannot silently bypass #297 #470 strict-stamps gate)

Dependencies / related

• builds on: ci(bundle): wire netlib_url_scheme/syscall_entry_stub/ipc_bounds/harness_defense into TEST_TARGETS (substrate host gates) #514, fix #514: wire syscall_entry_stub/ipc_bounds/netlib_url_scheme/harness_defense into bundle TEST_TARGETS #515 (ipc_bounds + syscall_entry_stub wired into bundle), ci(abi): validate_abi_stamps strict mode — promote 'no_stamp_line' SKIP to FAIL so future ABI docs cannot silently bypass #297 #470 (strict ABI stamp gate)
• ABI surface: docs/abi/ipc-wire.md (BUILD_ROADMAP §7)
• matrix: BUILD_ROADMAP §6.2 nightly capability matrix — this fills the wire-shaped negative-path dimension
• does NOT depend on M7 toolchain work; can land in parallel

Out of scope

• Any change to the IPC error code enum itself (the slice pins today's contract)
• Capability-shaped negative paths (covered separately by cap_* tests and docs/abi/capability-deny-contract.md)

[rwrife]

Daily maintenance update (2026-07-30): refreshed branch/PR #735 onto latest main, removed stale maintenance-state churn, and re-ran targeted gates locally.\n\nLocal verification:\n- bash build/scripts/test.sh ipc_wire_malformed\n- bash build/scripts/test.sh ipc_sync_v0\n- bash build/scripts/test.sh ipc_bounds\n- bash build/scripts/test.sh validate_abi_stamps\n\nAll passed after refreshing docs/abi/ipc-wire.md Last verified stamp to the content commit.